GD Rating System <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting via Rating Item 'title' and 'url' Arguments
- ID
- WPSEC-2026-0334
- Plugin
- GD Rating System (gd-rating-system)
- Affected
- from 3.0 before 3.7.2
- Remediation
- Update to 3.7.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- GD Rating System on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-93430, on 2026-10-02.
Description
The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' and 'url' rating item arguments in versions 3.0 up to, and including, 3.7.1. The plugin saves these arguments as rating item meta without sufficient input sanitization and outputs the stored values without escaping in rating lists, widgets and the plugin's admin dashboard and ratings pages. The arguments are accepted from the render data of the publicly accessible gdrts_live_handler AJAX action, as well as from rating shortcode attributes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user, including an administrator, accesses a page displaying the affected rating item.
References
- https://wpsec.com/vuln/WPSEC-2026-0334/
- https://plugins.svn.wordpress.org/gd-rating-system/tags/3.7.2/
- https://wordpress.org/plugins/gd-rating-system/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS